Hardware Security Implications of Reliability, Remanence, and Recovery in Embedded Memory
Total Page:16
File Type:pdf, Size:1020Kb
Journal of Hardware and Systems Security https://doi.org/10.1007/s41635-018-0050-5 Hardware Security Implications of Reliability, Remanence, and Recovery in Embedded Memory Sergei Skorobogatov1 Received: 9 July 2018 /Accepted: 27 September 2018 # The Author(s) 2018 Abstract Secure semiconductor devices usually destroy key material on tamper detection. However, data remanence effect in SRAM and Flash/EEPROM makes secure erasure process more challenging. On the other hand, data integrity of the embedded memory is essential to mitigate fault attacks and Trojan malware. Data retention issues could influence the reliability of embedded systems. Some examples of such issues in industrial and automotive applications are presented. When it comes to the security of semiconductor devices, both data remanence and data retention issues could lead to possible data recovery by an attacker. This paper introduces a new power glitching technique that reduces the data remanence time in embedded SRAM from seconds to microseconds at almost no cost. This would definitely help in designing systems with better secret key guarding. Data remanence in non-volatile memory could be influenced in the same way. The effect of data remanence and data retention on hardware security is discussed and possible countermeasures are suggested. This should raise awareness among the designers of secure embedded systems. Keywords Data remanence . Data retention . SRAM . EEPROM . Flash . Glitching . Hardware security . PUF . PRNG 1 Introduction industrial equipment, etc. It seems that a serious reliability issue was overlooked, and we might see more systems and Semiconductor memory in the form of static RAM (SRAM) devices starting to behave unpredictably or stop working. If it was introduced in the 1960s. It was later found to have data is a toaster or microwave oven, you can cope, but what about remanence problems similar to magnetic media with reliable old electronics equipment used in cars, aircrafts, and industrial data deletion [1–4]. Reprogrammable non-volatile memory infrastructure? Previous research on car systems showed how (NVM) was first introduced as EEPROM in the late 1970s the malfunction of certain car modules could pose a serious and then as Flash in the 1980s. They were also found to be threat to passengers [7, 8]. In this research, possible cause of affected by data remanence [5, 6]. As a result, there is possi- embedded system sporadic failures was found and this could bility that some information can still be extracted from previ- have very serious consequences. ously erased memory. This could create problems with secure In the 1980s, it was realised that low temperatures can devices where designers assumed that all sensitive informa- increase the data retention time of SRAM to many seconds tion is gone once the memory is erased. If the passwords or or even minutes. With the devices available at that time, it was secret keys can be extracted afterwards, it could affect confi- found that increased data retention started at about − 20 °C dentiality of the previously encrypted information. and increased as temperature fell further [2]. Some devices are Reliability of data storage is paramount for modern embed- therefore designed with temperature sensors; any drop below ded systems. Many people have come across situations when − 20 °C is treated as a tampering event and results in immedi- some microcontroller-based systems started behaving odd or ate memory zeroisation [9, 10]. The experiments described in stopped working. This might be home appliances, cars, this paper are set to measure the data remanence in modern microcontrollers to see if the low temperature data remanence still exists in embedded devices. * Sergei Skorobogatov Usually, the data remanence problem is tackled by wrap- [email protected] ping the device into tamper protection enclosure with temper- 1 Department of Computer Science and Technology, University of ature sensors to prevent freezing and tamper sensors to detect Cambridge, Cambridge, UK intrusion [9–11]. This gives enough time to safely wipe secret J Hardw Syst Secur key off the memory contents. However, designing a device 2.1 Data Remanence with embedded SRAM having a low data remanence comes at a cost. This often requires modifying the SRAM cells to in- Security engineers are interested in the period of time for corporate an additional destruction signal [12]. On practice, which an SRAM device will retain data once the power has this means that developers have very narrow choice of been removed. This is because many products do crypto- microcontrollers and system-on-chip (SoC) devices with such graphic and other security-related computations using secret capability. For example, Maxim Integrated (former Dallas keys or other variables that the equipment’soperatormustnot Semiconductor) offers secure microcontroller DS5250 with be able to read out or alter. The usual solution is for the secret two self-destruct inputs which on activation wipe off the data to be kept in volatile memory inside a tamper-sensing memory contents within microseconds [13]. Data remanence enclosure. On detection of a tampering event, the volatile in NVM is usually defeated by several cycles of erasing and memory chips are powered down or even shorted to ground. overwriting operations [6]. However, this cannot be accom- If the data retention time exceeds the time required by an plished in a short time especially for devices with a large opponent to open the device and power up the memory, then memory size. the protection mechanisms can be defeated. Chip manufacturers do not publish information about On power up, the symmetric SRAM cells are tend to go remanence effects in their chips. Of course, a developer more likely into one of the states 0 or 1. Each chip has unique can run data remanence tests on a selected batch of and uncontrollable biases for each memory cell that depends suitable chips. But this would take time and add cost on the intrinsic properties of semiconductor production. This to the design. The outcome of this research can be used helps to distinguish between each individual chip as well as to improve the protection of secure systems which use use this for each device having unique PUF key for encryp- SRAM as a source of randomness and unique keys. tion. However, data remanence imposes some limitations on First is used in pseudorandom number generators the time between each initialisation. Otherwise, either random (PRNG) employed in many cryptographic protocols. number will be predictable or the data used in PUF will always Others are used to derive unique keys from physical be the same making cloning much easier. unclonable functions (PUF). By reducing the data rem- Another important thing to keep in mind is that security anence time, the contents of the SRAM can be information could be restored even if part of the memory is refreshed more often and with higher randomness. The corrupted. If an attacker has correctly restored only 90% of the research presented in this paper demonstrates that 128-bit key, he will have to search through n!/(m!(n–m)!) = SRAM data remanence problem still exists in modern 128!/(115!13!) = 2.12 × 1017 ~258 possible keys. This is fea- microcontrollers and like before deteriorates at low tem- sible to calculate in an hour with a medium-size cluster of peratures. This paper offers a low-cost solution to computers or by using special hardware key cracker device. completely eliminate the data remanence problem at al- If only 80% of the information is known, an attacker will need most no cost. It also demonstrates that Flash/EEPROM 2.51 × 1026 ~288 searches. Having even 100 times the capa- can be affected in the same way, and this could have bility, the attacker will spend more than a million years influence on the security of embedded systems. searching for the key. To simplify data remanence time calcu- Data retention can affect reliability of automotive and in- lations, we assume that if 50% of information is lost, then the dustrial systems. The results of this research should be of key cannot be recovered anymore. considerable concern to the developers of secure devices. Unlike SRAM, which has only two stable logic states, This paper makes the following contributions: it demon- EPROM, EEPROM, and Flash cells store analogue values in strates that data remanence effect is present in embedded the form of a charge on the floating gate of a MOS transistor. SRAM; it suggests a solution to significantly reduce data rem- The floating-gate charge shifts the threshold voltage of the cell anence time; it reveals that negative power glitching affects transistor, and this is detected with a sense amplifier when the the security of some microcontrollers; it exposes security is- cell is read. sues related to short data retention time of embedded EEPROM. 2.2 Data Retention Programmed floating-gate memories cannot store information 2 Background forever. Up until the late 1990s, these cells were not robust enough and usually held the charge for only 10–20 years. The Embedded systems are often based on microcontrollers— failure mechanisms of EEPROM and Flash memory cells are small integrated circuits with SRAM, ROM, EEPROM, and well known. Various processes, such as field-assisted electron Flash on a single silicon die. Two opposite effects were eval- emission, de-trapping of electrons, and ionic contamination, uated in this paper—data remanence and data retention. cause the floating gate to lose its charge, and this increases at J Hardw Syst Secur higher temperatures [14]. Flash memory inherited similar data engineer, it would be natural to overlook the important param- retention problems associated with the nature of data storage eters omitted by the manufacturer. The consequences could be on a floating gate from the EEPROM. The failure rate doubles devastating especially for high-risk applications.